Executive Summary
Cisco Talos has identified a sophisticated threat actor, UAT-10362, conducting targeted spear-phishing campaigns against non-governmental organizations and universities in Taiwan. The campaigns deliver a newly discovered malware family named LucidRook, a 64-bit Windows DLL stager that integrates a Lua interpreter and Rust-compiled libraries to execute modular payloads. The actor also utilizes a companion reconnaissance tool called LucidKnight to profile targets and exfiltrate data via Gmail.
The attack chain involves multi-stage droppers, such as LucidPawn, which utilize geo-targeting execution gates to ensure the malware only runs in Traditional Chinese environments. UAT-10362 demonstrates mature tradecraft by abusing legitimate OAST services for connectivity checks and leveraging compromised FTP servers from Taiwanese printing companies for C2 infrastructure. The use of Living-off-the-Land Binaries (LOLBAS) and sideloading through DISM components further complicates detection efforts.
This activity represents a targeted intrusion focused on long-term access and intelligence gathering within Taiwan. The modular nature of the toolkit and the actor's ability to customize Lua bytecode payloads per target indicate a capable adversary with significant engineering investment in stealth and operational security.